
California Finalizes Groundbreaking Regulations on AI, Risk Assessments, and Cybersecurity, Part III: Risk Assessments
On September 23, 2025, the California Office of Administrative Law (OAL) approved regulations under the California Consumer Privacy Act (CCPA) that specifically address the use of artificial intelligence (AI) and automated decisionmaking technologies (ADMTs), requirements for completing risk assessments, and annual cybersecurity audits. This article is the third and final installment of a three-part series exploring the new requirements. Our first article focused on the ADMT provisions, and our second article addressed the requirements surrounding cybersecurity audits.